Re: [PATCH v3 38/40] drm/vmwgfx: Convert to atomic_create_state

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Dangling pointer leading to Use-After-Free in vmw_du_connector_reset when kzalloc_obj fails.
--

commit 0910404d300f75561678f127f981fe7f17dcd288
Author: Maxime Ripard <mripard@kernel.org>

drm/vmwgfx: Convert to atomic_create_state

The plane reset implementation creates a custom state
subclass, but only initializes a pristine state without resetting any
hardware. This is equivalent to what atomic_create_state expects.
Convert to it.

> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
> index 0b470809661c7..9031dccad31d7 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
> @@ -279,27 +279,24 @@ vmw_du_plane_duplicate_state(struct drm_plane *plane)
>  
>  
>  /**
> - * vmw_du_plane_reset - creates a blank vmw plane state
> + * vmw_du_plane_create_state - creates a blank vmw plane state
>   * @plane: drm plane
>   *
> - * Resets the atomic state for @plane by freeing the state pointer (which might
> - * be NULL, e.g. at driver load time) and allocating a new empty state object.
> + * Allocates a new empty state object.
>   */
> -void vmw_du_plane_reset(struct drm_plane *plane)
> +struct drm_plane_state *vmw_du_plane_create_state(struct drm_plane *plane)
>  {
>  	struct vmw_plane_state *vps;
>  
> -	if (plane->state)
> -		vmw_du_plane_destroy_state(plane, plane->state);
> -
>  	vps = kzalloc_obj(*vps);
> -
>  	if (!vps) {
>  		DRM_ERROR("Cannot allocate vmw_plane_state\n");
> -		return;
> +		return ERR_PTR(-ENOMEM);
>  	}

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing this change I
noticed a similar pre-existing issue remains in vmw_du_connector_reset().

When kzalloc_obj() fails during memory pressure (e.g., during device probe,
modeset, or hotplug handling), connector->state is left dangling as a pointer
to the previously freed memory:

drivers/gpu/drm/vmwgfx/vmwgfx_kms.c:vmw_du_connector_reset() {
	if (connector->state) {
		__drm_atomic_helper_connector_destroy_state(connector->state);
		kfree(vmw_connector_state_to_vcs(connector->state));
	}

	vcs = kzalloc_obj(*vcs);

	if (!vcs) {
		DRM_ERROR("Cannot allocate vmw_connector_state\n");
		return;
	}
	...
}

Does this leave connector->state pointing to freed memory, leading to a
use-after-free when the DRM core later accesses it?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831-drm-no-more-plane-reset-v3-0-1877c7aa57b3@kernel.org?part=38